AppSec Staff Engineer

Academic Key; West of England; Hybride; GBP 106 000 - 132 000; Plein temps

Avantages offerts par ce poste

26 days holiday

Private medical insurance

Life assurance

Pension scheme

Mortgage advice

Résumé du poste

Kaluza is hiring a Staff Engineer (Security Engineering) to join the Security Engineering team in Bristol. You will mentor engineers, influence security across product teams and lead the evolution of security practices in a complex environment.

You will work with leadership to shape strategy, implement secure systems, and ensure compliance while balancing speed and risk. Hybrid work, competitive salary and security-focused culture are offered.

Qualifications

• Experience mentoring engineers and collaborating closely (pairing, swarming).
• Deep understanding of software security flaws and web app security best practice (OWASP Top 10, CWE/SANS Top 25).
• Extensive knowledge of CI/CD and DevOps security considerations.
• Scripting skills and hands-on software development at scale.
• Working knowledge of Okta to enforce access management policies.
• Awareness of AWS and/or GCP security best practices; IaC tooling like Terraform.

Responsabilités

• Integrate security tooling and use AI to prevent, detect and respond to threats.
• Shape technical strategy and solutions architecture with senior leaders; align security, risk and compliance with engineering decisions.
• Mentor and train product and engineering teams to deliver secure systems quickly and cultivate a strong security culture.
• Provide guidance on identifying, prioritising, and mitigating systemic risks and vulnerabilities.
• Lead evolution of security best practices across the SDLC; support teams with expert advice and automation.
• Influence stakeholders across Kaluza and client teams.
• Mentor and coach security and software engineers to balance risk with speed and quality.
• Build relationships with third-party security vendors and industry bodies to stay ahead of emerging practices.

Connaissances

Mentoring engineers

Web security expertise

CI/CD security

Scripting skills

Okta knowledge

AWS/GCP security

Terraform

Architectural patterns

Outils

Okta

Terraform

Description du poste

# AppSec Staff Engineer**Kaluza** · BristolAbroad Bristol✓ Link validatedLocation: Bristol, UK (hybrid, three days a week in the office) Level: Staff Engineer (TL2) Team: Security Engineering, within the Cyber Security squad Salary: £105,600 – £132,000 + discretionary bonus Contract: Permanent Reporting to: Senior Software Engineering Manager Please note: This role requires an existing right to work in the UK . We can’t offer visa sponsorship, but we review sponsorship role by role, so keep an eye on our careers site for future opportunities. About Kaluza Kaluza is the Energy Intelligence Platform, turning energy complexity into seamless coordination. We help energy companies overcome today’s challenges while accelerating the shift to a clean, electrified future. Our platform orchestrates millions of real-time decisions across homes, devices, markets and grids. By combining predictive algorithms with human-centred design, Kaluza makes clean energy dependable, affordable and adaptive to everyday life. With teams across Europe, Asia and Australia, and a joint venture with Mitsubishi Corporation in Japan, we power leading companies including OVO, AGL and ENGIE, as well as innovators like Volvo and Volkswagen. What you’ll do You’ll join the Security Engineering team, working alongside our cyber security leadership, architecture team and technical leaders across engineering. Our mission is to equip teams to build and innovate while upholding security best practice and protecting client data in the highly regulated energy sector. Integrate security tooling and use AI to prevent, detect and respond to emerging threats Work with senior technical leadership to shape our technical strategy and solutions architecture, so security, risk and compliance feed into technical decisions Help product teams deliver secure systems quickly by building a strong security culture through mentoring, design reviews and training Give product and engineering teams practical guidance on identifying, prioritising and mitigating systemic risks and vulnerabilities Lead the evolution of our security best practice across application development and the wider SDLC, supporting teams with expert advice and automation Influence technical and non-technical stakeholders across Kaluza and client teams Mentor and coach security and software engineers to balance risk with speed and quality Build relationships with third-party security vendors and industry bodies to keep us at the forefront of emerging practices, tooling and standards What you’ll bring Ideally, you’ll have: Extensive experience mentoring engineers and collaborating closely (e.g. pairing, swarming) Deep understanding of software security flaws and web application security best practice (OWASP Top 10, CWE/SANS Top 25) Extensive knowledge of CI/CD and DevOps principles, and their security considerations Experience applying AI in your own work and helping others build it safely into how they develop Scripting skills and first-hand experience of software development at scale Working knowledge of Okta or equivalent, to enable workforce identity and enforce access management policies Awareness of AWS and/or GCP security best practice, and some experience with infrastructure as code (e.g. Terraform) Experience applying architectural and software design patterns in a complex environment You’ll also be: A pragmatic, risk-based decision-maker who weighs the technical and commercial consequences of your choices Skilled at influencing upwards and outwards, with great communication skills Able to set a clear vision for large-scale technical direction and align multiple teams behind it Keen to drive compliance and NFR improvements that balance information security and commercial goals Committed to a culture of learning and improvement, and willing to challenge engineering leadership to support it Skills (SFIA): We use the SFIA framework to assess and develop our security engineers. Levels run from 1 to 7. Essential: Level 6: Systems design Level 5: Information security , specialist advice , systems development lifecycle , solution architecture , emerging technology monitoring Level 4: Information assurance , information and data compliance Desirable: Identity and access management (Level 5), software development (Level 6), learning delivery (Level 3), and information assurance stepping up to Level 5 Our values Five values guide how we work at Kaluza: Play to win: Collective pride in decarbonising energy at scale. Solve the real problem: Cutting through complexity to focus on real-world outcomes. Build trust every day: Consistency, transparency and doing what we say. Own the outcome: Full accountability, wins and setbacks, without ego. Go further together: Collaboration, respect and different perspectives. Our perks Time off and family: 26 days’ holiday [plus/including bank holidays], plus 26 weeks’ full pay for new parents with no qualifying service period Health and security: Private medical insurance with virtual GP, life assurance, pension scheme, free mortgage advice